NIS2, the CRA and IEC 62443 for manufacturers, in one place
Medium-sized and large manufacturers of machinery, electronics, electrical equipment and vehicles fall under NIS2. Many also make products with digital elements that the Cyber Resilience Act will regulate, and run operational technology that customers expect to be secured to IEC 62443.
In short: Manufacturers in NACE C26 to C30 (computers and electronics, electrical equipment, machinery, motor vehicles and other transport equipment) and makers of medical devices and in vitro diagnostic medical devices are in NIS2 scope as “other critical” entities when they are at least medium-sized. Secrato maps NIS2, CyFun®, the CRA and IEC 62443 to one set of controls, so plant, product and company security share the same evidence.
Manufacturing is a critical sector under NIS2
NIS2 lists manufacturing in Annex II. Medium-sized and large manufacturers are usually important entities: they must take the risk-management measures of Article 21, report significant incidents within 24 hours, 72 hours and one month, and their management body is accountable. Group structure counts, so a small plant that belongs to a large group is usually treated as large. Check your scope in two minutes →
One control set for the plant, the product and the company
Cover the shop floor, not just the office
Model plants, production lines and OT zones as assets, link them to risks and controls, and keep evidence per site. Framework mapping lets IEC 62443 and ISO/IEC 27001 controls satisfy the matching NIS2 measures, so OT and IT teams work from the same record.
Get ready for the Cyber Resilience Act
Track products with digital elements, their vulnerability handling and the technical documentation the CRA requires. Reporting of actively exploited vulnerabilities and severe incidents starts on 11 September 2026; all other requirements apply from 11 December 2027.
Answer your customers' security questions
Your customers in scope of NIS2 must manage supply-chain risk, so they send you questionnaires. Keep answers, certificates and policies in one place and share them through a trust centre, instead of rewriting them for every request.
BUILT FROM BELGIUM
Rules that come together for manufacturers in the Benelux
In Belgium, manufacturers register with the CCB via Safeonweb@Work and can use CyFun® or ISO/IEC 27001 to show the NIS2 measures. In the Netherlands, they register with the NCSC via MijnNCSC under the Cyberbeveiligingswet. On top of NIS2 come the Cyber Resilience Act for products, the Machinery Regulation for new machinery from January 2027, and IEC 62443 in customer contracts.
Secrato is built in Belgium and hosted in a Tier IV data centre in Antwerp. Start with the free CRA readiness checklist or read the CRA step-by-step guide.
Common questions
Are manufacturers in scope of NIS2?
Yes, if they make products in NACE C26 to C30 (computer, electronic and optical products, electrical equipment, machinery, motor vehicles and other transport equipment) or medical devices and in vitro diagnostic medical devices, and they are at least medium-sized: 50 or more staff, or turnover and balance sheet both above €10 million. They are usually important entities. Use the NIS2 scope checker for a first answer.
How do NIS2 and the Cyber Resilience Act fit together for manufacturers?
NIS2 covers how you secure your organisation and operations; the CRA covers the security of the products with digital elements you place on the EU market. Many controls overlap, such as vulnerability handling, incident reporting and supplier security. Secrato maps both to the same controls so evidence is collected once.
Does Secrato support IEC 62443 for OT security?
Yes. IEC 62443 is one of the frameworks in Secrato and can be mapped to NIS2, CyFun® and ISO/IEC 27001, so OT measures count towards your NIS2 risk-management obligations.
We are a small supplier. Do we need to do anything?
Small manufacturers are usually out of NIS2 scope themselves, but customers that are in scope will ask how you manage security. A recognised baseline such as CyFun® BASIC gives you a credible answer; the free NIS2 Starter is built on it.
See how Secrato maps NIS2 to your plants and products
Show us your sites, products and frameworks, and we will map them to one control set in Secrato.
